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1 .  Introduction 

The  existence  of  fair  arbiters  and  formal  specifications  for  them  was  a  major  topic  of  discussion  at 
the  Workshop.  One  of  the  many  results  discussed  is  that  it  is  possible  to  create  a  fair  arbiter  by 
adding  output  delays  to  a  mutual  exclusion  element  [1],  This  work  builds  on  that  result  by 
investigating  the  basic  fairness  properties  of  mutual  exclusion  elements  and  combinations  thereof. 
Rather  than  working  with  a  particular  mutual  exclusion  element,  we  abstract  the  behavior  of  a  class  of 
such  elements  using  a  choice  set  model  and  a  probabilistic  specification  of  the  choice  inherent  in 
mutual  exclusion.  This  allows  us  to  capture  the  choice  behavior  of  a  mutual  exclusion  element  in  a 
probabilistic  structure  containing  finite  and  infinite  traces.  To  analyze  such  structures  we  employ 
techniques  from  the  mathematical  discipline  of  measure  theory,  and  in  particular  the  measure 
theoretic  treatment  of  probability.  The  major  result  from  this  analysis  is  tha*  mutual  exclusion 
elements  are  fair  under  a  strong  probabilistic  notion  of  fairness.  This  notion  is  similar  to  the  standard 
notions  used  in  [1];  its  major  advantage  is  that  unlike  the  standard  notions,  it  can  be  analyzed  using 
probability  and  measure  theory  techniques.  A  complete  introduction  and  explanation  of  measure 
theory  is  neither  possible  nor  desirable  in  this  context;  the  interested  reader  is  urged  to  consult  a 
standard  text  such  as  [3].  Similarly  we  assume  a  familiarity  with  the  common  notions  of  fairness 
discussed  in  [1], 

2.  Modeling  Mutual  Exclusion  Elements 

A  mutual  exclusion  element  enforces  mutual  exclusion  among  grants  to  concurrent  competing 
requests  for  a  shared  resource.  For  the  present  we  consider  only  two  input  mutual  exclusion 
elements;  generalizations  to  larger  elements  and  arbiters  containing  multiple  mutual  exclusion 
elements  will  be  discussed  in  a  later  section.  To  quantify  the  fairness  of  a  mutual  exclusion  element, 
there  are  three  facets  of  its  behavior  that  must  be  modeled: 

•  Which  requests  are  granted  in  what  order? 

•  What  are  the  possible  choices  for  each  grant? 

•  For  those  grants  that  require  a  choice  between  requests,  how  is  that  choice  made? 

We  use  a  choice  set  model  for  the  first  two  items  and  a  probabilistic  model  for  the  final  item;  these 
models  are  discussed  in  the  following  sections  For  a  two-input  mutual  exclusion  clement  we  denote 
the  competing  requests  by  rQ  and  r y  and  their  corresponding  grants  by  gQ  and  gr 


2.1 .  Choice  Sets 

For  an  individual  grant  by  a  mutual  exclusion  element,  we  define  the  choice  set  to  be  the  set  of 
outstanding  requests  that  could  be  granted  (including  the  request  actually  granted).  To  analyze 
fairness  we  consider  sequences  of  such  grants  and  corresponding  choice  sets.  Since  previous  work 
has  shown  that  infinite  notions  of  fairness  are  necessary  for  delay-insensitive  arbitration  among 
independent  processes  [1],  we  restrict  our  attention  to  infinite  sequences.  Therefore  our  choice  set 
model  of  an  arbiter  is  the  set  of  all  infinite  sequences  of  <grant, choice  set>.  We  call  such  a  sequence 
an  infinite  choice  sequence. 

Because  any  two-input  mutual  exclusion  element  makes  dichotomous  choices  between  competing 
inputs,  it  must  exhibit  metastable  behavior.  One  can  intuitively  understand  metastable  behavior  as 
that  of  a  man  sitting  on  a  fence  who  cannot  decide  on  which  side  of  the  fence  the  grass  is  greener 
and  therefore  remains  on  the  fence.  The  corresponding  behavior  of  circuits  (making  no  choice 
because  both  are  equally  attractive)  is  real  and  has  been  demonstrated  for  synchronizers,  arbiters, 
and  related  circuits  [2].  Just  as  the  man  will  eventually  get  off  the  fence,  a  well-designed  circuit  will 
eventually  make  a  choice;  there  is  no  upper  bound  on  the  time  required  to  make  this  choice,  but  it  is 
known  to  be  exponentially  distributed  [4],  In  the  correspondence  of  our  choice  set  model  with  any 
actual  mutual  exclusion  element,  we  require  that  any  non-singleton  choice  set  correspond  to 
metastable  behavior. 

2.2.  Probabilistic  Behavior 

The  final  aspect  of  mutual  exclusion  element  behavior  that  we  need  to  model  is  the  mechanism  of 
making  choices  among  elements  of  a  choice  set.  For  this  work  we  adopt  the  following  simplifying 
assumptions: 

•  In  any  sequence  of  choices,  all  choices  are  mutually  independent. 

•  If  a  choice  set  contains  both  requests,  then  there  are  fixed  probabilities  for  each  request 
(ro,r-i) t0  be  granted,  and  these  probabilities  are  identical  for  all  such  choice  sets. 

These  assumptions  formalize  our  requirement  that  two-element  choice  sets  correspond  to  metastable 

behavior,  and  model  metastable  behavior  as  essentially  invariant  over  choices  by  fixing  the 

probabilities  associated  with  each  grant  for  a  given  mutual  exclusion  element.  We  denote  these 

probabilities  by  pQ  and  pr  and  note  that  their  sum  must  be  I.  In  practice  one  would  expect  these  exit 

or  resolving  probabilities  to  have  values  close  to  0.5  [5], 

Minor  variations  of  these  probabilities  do  not  change  our  results,  but  drastic  variations  (such  as  one 
of  the  probabilities  becoming  zero)  invalidate  the  results.  Chaney  has  obseived  short  term 


dependencies  in  exit  probabilities  among  choice  sets  for  some  flip-flops  [6];  in  the  absence  of  long¬ 
term  dependencies  we  rely  on  the  law  of  averages  to  remove  any  short-term  effects  from  our  analysis 
of  infinite  sequences  of  choices  (i.e.  our  first  assumption  above  is  justified  in  part  because  we  are 
interested  only  in  infinite  sequences  of  choices;  it  may  be  an  unwarranted  assumption  for  short  finite 
sequences).  Finally,  Sproull  has  noted  that  although  these  assumptions  are  reasonable  for  well- 
designed  mutual  exclusion  elements,  there  are  pitfalls  in  designing  MOS  mutual  exclusion  elements 
that  may  produce  elements  that  violate  these  assumptions.  The  major  potential  problem  is  that  every 
wire  in  a  MOS  circuit  has  capacitance  and  therefore  memory  properties,  including  the  wires  used  to 
cross-couple  the  inverting  gates  in  a  mutual  exclusion  element;  the  inadvertant  introduction  of 
memory  in  these  wires  can  produce  a  mutual  exclusion  element  that  unfairly  favors  one  of  its  requests 
[7],  This  is  one  of  the  many  areas  in  which  appropriate  care  and  diligence  are  required  on  the  part  of 
the  circuit  designer. 

2.3.  Fairness  and  its  Analysis 

To  analyze  the  fairness  of  a  mutual  exclusion  element  we  need  consider  only  its  choice  behavior 
when  there  is  a  choice  to  be  made;  therefore  from  any  choice  set  sequence  we  are  interested  in  the 
unique  subsequence  consisting  solely  of  choice  sets  containing  both  requests.  Such  a  subsequence 
is  completely  specified  by  the  sequence  of  grants  because  all  the  choice  sets  are  identical. 
Furthermore,  we  are  interested  only  in  such  sub  sequences  which  are  infinite;  if  this  subsequence  is 
finite,  then  after  some  finite  point  in  the  original  sequence  every  request  is  immediately  granted  (i.e. 
each  choice  set  is  of  size  1,  therefore  that  request  is  the  granted  request).  This  is  certain  to  be  fair 
under  an  infinite  notion  of  fairness  as  it  excludes  starvation.  A  consequence  of  our  modeling 
assumptions  is  that  the  likelihood  of  any  such  subsequence  or  collection  thereof  depends  solely  upon 
the  probabilities  pQ  and  p1  corresponding  to  the  grant  choices  in  the  subsequence(s). 

We  now  define  fairness  for  both  choice  set  sequences  and  mutual  exclusion  elements. 

Definition  1:  Weak  Fairness  for  Sequences:  A  choice  set  sequence  is  fair  iff  any 
continually  asserted  request  is  eventually  granted  (i.e.  the  sequence  is  fair  iff  for  any 
request  appearing  in  any  choice  set,  EITHER  the  corresponding  grant  appears  in  that  or  a 
subsequent  sequence  element,  OR  there  is  a  subsequent  choice  set  in  which  the  request 
does  not  appear). 

When  applied  to  our  two-element  choice  set  subsequences  this  requires  that  every  request 
eventually  be  granted  in  the  subsequence;  this  is  a  stronger  condition  than  requiring  every  request  to 
be  granted  in  the  corresponding  original  sequences.  The  following  definition  employs  this  stronger 
condition. 

Definition  2:  Probabilistic  Fairness  for  Mutual  Exclusion  Elements  A  mutual 
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exclusion  element  M  is  fair  if  the  probability  of  unfair  infinite  two  element  choice 
subsequences  in  the  space  of  all  infinite  two-element  choice  subsequences  is  zero. 

Weak  fairness  for  a  mutual  exclusion  element  requires  that  every  continually  asserted  request 
eventually  be  granted  [1];  the  above  definition  implies  the  similar  condition  that  every  continually 
asserted  request  be  granted  with  probability  1.  The  difference  between  these  ttoo  conditions  is  that 
the  latter  allows  unfair  behavior  with  probability  zero,  in  a  finite  domain  of  possible  behaviors,  zero 
probability  behaviors  cannot  occur;  for  an  infinite  domain  the  corresponding  condition  is  that  within 
any  infinite  sequence  of  randomly  chosen  behaviors  from  the  domain,  a  behavior  of  probability  zero 
may  appear  at  most  finitely  many  times.  Although  the  difference  between  this  condition  and  an  event 
never  occurring  can  be  of  great  theoretical  importance,  we  believe  that  it  is  relatively  unimportant  in 
practice;  in  both  cases  the  probability  of  a  request  not  being  granted  is  zero,  and  this  is  an  adequate 
notion  of  fairness  for  most  purposes. 

To  establish  our  desired  result  on  the  fairness  of  mutual  exclusion  elements  we  need  to  consider  the 
probability  of  unfair  infinite  two-element  choice  sequences  (an  infinite  set)  within  the  space  of  all 
infinite  two-element  choice  sequences  (another  infinite  set).  Towards  this  end  we  now  discuss 
measure  theory,  which  provides  a  rich  set  of  tools  for  this  task. 

3.  Measure  Theory 

Measure  theory  is  a  branch  of  mathematics  concerned  with  functions  that  produce  the  'size'  of  sets; 
these  set  functions  are  called  measures.  A  primitive  example  of  a  measure  for  intervals  of  the  real 
number  line  is  the  function  that  produces  the  length  of  the  interval.  Measures  are  most  interesting 
and  most  useful  when  the  sets  involved  are  infinite;  this  is  precisely  the  situation  that  we  are 
considering  in  analyzing  the  fairness  of  mutual  exclusion  elements.  The  particular  class  of  measures 
we  use  are  often  called  probability  measures  because  they  determine  the  measure  of  a  set  by  the 
probability  of  the  'events'  it  contains.  (The  quoted  terms  are  for  the  reader's  intuition  only;  we  do  not 
intend  to  provide  formal  definitions.) 

3.1 .  Introduction 

This  section  presents  a  quick  introduction  to  measure  theory  abstracted  from  [3],  Further  details 
can  be  found  there.  This  section  may  be  skipped  on  first  reading,  as  it  is  necessary  only  for  the  proof 
of  the  main  result. 

Rings  and  <j-rings  are  the  mathematical  objects  on  which  measures  are  defined'. 

Definition  3:  Pings  and  algebras  of  Sets:  A  ring  o /  sr  ls  is  a  non  empty  class  I?  of 


sets  which  is  closed  under  the  formation  of  set  unions  and  differences.  Formally  a  non¬ 
empty  class  R  is  a  ring  iff 

For  all  F €  R  and  Fe  R,  Fu  Fe  R  and  F  -  Fe  R 

A  a-ring  of  sets  is  a  ring  of  sets  closed  under  the  formation  of  countable  unions. 
Formally  a  ring  of  sets  S  is  a  a-ring  iff 

If  F.e  S  for  i  =  1,2, .  . .  then  U “,/■)€  S 

A(n)  (o-)algebra  is  a  (a-)ring  that  contains  the  union  of  all  its  elements.  An  equivalent 
definition  of  a(n)  (a-)algebra  is  that  it  is  a  (a-)ring  that  is  closed  under  set  complementation 
of  its  individual  elements. 

This  work  relies  primarily  upon  a-algebras,”  the  other  rings  and  algebras  are  used  to  present  the 
definitions  and  results  of  measure  theory  in  full  generality. 

A  measure  is  a  function  that  'measures'  the  ’size’  of  sets  in  a  ring.  We  now  formally  define  this 
concept: 

Definition  4:  Measure:  An  extended  real  valued  function  is  a  function  whose  range  is 
®JbU  {  +  co,“oo}  where  denotes  the  real  numbers. 

A  set  function  is  a  function  whose  domain  is  a  class  of  sets  (a  ring  or  an  algebra  for 
example). 

An  extended  real  valued  set  function  ^  defined  on  a  class  E  is  countably  additive  if,  for 
every  disjoint  sequence  {F  }  of  sets  in  E  whose  union  is  also  in  E,  we  have 

MU”, £„)  =  !><*,) 

n=l 

A  measure  is  an  extended  real  valued,  non-negative,  and  countably  additive  set  function 
/x,  defined  on  a  ring  R  such  that  /i(0)  =  0. 

For  an  algebra  A,  let  Jbe  the  union  of  all  sets  in  the  algebra.  Then  a  measure  ju  is  totally 
finite  iff  j u(X)  is  finite. 

Probability  measures  are  always  totally  finite  because  the  set  X.  includes  all  possible  'events’,  and  the 
probability  of  at  least  one  'event'  occurring  is  1.  (i.e  for  a  probability  measure  /x,  not  only  is  /x(A') 
finite,  but  in  fact  n(X)  =  1 ). 

Any  measure  on  any  ring  satisfies  the  following  property,  called  countable  subadditivity:  for  every 

sequence  {F  }  of  sets  in  ring  R  whose  union  is  also  in  R  the  following  is  true: 
oo 

^*F,><X>F.) 

f-i 

The  difference  between  this  and  countable  additivity  is  that  the  sequence  { /■'  }  was  of  rlisioint  sets  in 
the  definition  of  countable  additivity,  whereas  the  sequence  is  this  definition  need  not  be  disjoint;  this 
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results  in  the  equality  of  countable  additivity  being  replaced  by  the  inequality  contained  in  the  above 

definition. 

Our  desired  result  requires  reasoning  from  probabilities  of  individual  choices  to  probabilities  of 
sequences  of  choices.  In  a  probability  domain,  we  would  state  that  different  universes  of  choice  are 
involved;  the  corresponding  objects  in  measure  theory  are  called  measure  spaces. 

Definition  5:  Measure  Spaces:  A  measurable  space  is  a  set  X  and  a  a  ring  S  of 
subsets  of  -V  such  that  US  =  X.  A  subset  E  of  X  is  measurable  iff  E  belongs  to  the  cr- ring 

S. 

A  measure  space  is  a  measurable  space  (.V,S)  and  a  measure  ju  on  S.  A  measure  space 
(X.Sgi)  is  totally  Unite  iff  the  measure  /i  is  totally  finite. 

In  most  cases  it  causes  no  confusion  to  denote  a  measure  space  or  measurable  space  by  the  same 
symbol  as  the  underlying  set  X\  if  it  is  necessary  to  call  attention  to  the  specific  space  involved,  we 
use  the  notation  (,V,S)  for  measurable  spaces  and  (AAS./i)  for  measure  spaces. 

3.2.  Product  Measures 

To  prove  our  main  result  we  define  a  measure  space  corresponding  to  a  single  choice,  and  then 
extend  to  sequences  of  choices  by  taking  cartesian  products.  The  basic  result  we  need  from 
measure  theory  is  the  existence  of  the  product  probability  measures  on  cartesian  products.  To  state 
this  theorem  we  need  the  following  additional  definitions  and  results.  All  results  from  measure  theory 
are  stated  here  without  proof;  the  proofs  can  be  found  in  [3] 

Theorem  6:  If  E  is  any  class  of  sets,  then  the  class  of  rings  containing  E  has  a  unique 
minimal  element.  In  addition  the  class  of  a-rings  containing  E  also  has  a  unique  minimal 
element. 

Definition  7:  Generated  Rings:  In  view  of  the  preceding  theorem,  we  define  the  ring 
generated  by  E  to  be  the  unique  minimal  element  of  the  class  of  rings  containing  E  and 
denote  it  by  R (E) .  Similarly  we  define  the  a-ring  generated  by  E  to  be  the  unique  minimal 
element  uf  the  class  of  a-rings  containing  E  and  <j6»  i0i6  it  by  S(C). 

For  the  following  if  {.V }  is  an  infinite  sequence  of  sets,  then  .V'  denotes  their  cartesian  product, 

X  =  n“  A',  On  this  basis  we  can  define  the  remaining  concepts  that  are  needed  to  state  the  main 
result  of  this  section. 

Definition  8:  Measurability  for  Cartesian  Products:  For  each  set  .1  ,  let  S  be  a 
2-algebra  of  subsets  of  .V  ,  and  let  / 1  be  a  measure  on  S  such  ih.it  /i  (.V  )  =  I. 

A  rectangle  is  a  sot  of  the  form  [  |  c  ,-t  where  I  C.V  for  all  :  and  .1  --  A  for  all  but  a 
finite  number  of  values  of  /.  A  measurable  rectangle  is  a  ret  t;  nqie  for  which  each  f  is  a 


00 

A  subset  of  -V  =  n,=1-^,  's  measurable  iff  it  belongs  to  the  a-ring  (which  is  actually  a 
a-algebra)  generated  by  the  class  of  measurable  rectangles.  We  denote  this  a-algebra  by 


The  next  definition  defines  useful  terms  and  notations  for  dealing  with  products -of  measure  spaces. 

Definition  9:  Cylinders:  Let  J  be  any  subset  of  /,  the  positive  integers.  Then  two 
points  (in  X),  x  -  (xi,xr  .  .  . )  and  y  =  •  •  •  )  agree  on  .1  if  x.  =  for  every  j  in  J.  We 

write  this  as  x  =  y  (J). 

A  set  E  in  X  is  called  a  J-cylinder  if  x  =  y(J)  implies  that  x  and  y  either  both  belong  or 
both  do  not  belong  to  E. 

Finally  we  adopt  the  shorthand  X(n^  =  +  1  X,  for  non-negative  n.  This  allows  us  to 

write  any  /-cylinder  E  as  A x  X(n)  where  /( C  f|"=,  X  for  some  n. 

The  following  theorem  is  the  principle  measure-theoretic  result  necessary  to  prove  our  main 
fairness  result. 

Theorem  10:  Existence  of  Product  Measures:  If  {Tf  .S }  is  an  infinite  sequence 
of  totally  finite  measure  spaces  with  fi-(X  )  =  I,  then  there  exists  a  unique  measure  n  on 

the  a-algebra  S  =  n* :  with  the  property  that  for  every  measurable  set  E  of  the  form 
AxX(n), 

\i(E)  =  (jix  ■  ■  ■  x^)(/l). 

The  measure  /i  is  called  the  product  of  the  given  measures  p. ,  and  the  measure  space 
(A'.S./i)  is  called  the  cartesian  product  of  the  given  measure  spaces. 

4.  Fairness  of  Mutual  Exclusion  Elements 

4.1 .  The  Basic  Result 

Our  model  characterizes  mutual  exclusion  elements  by  their  resolving  probabilities  from  the 
metastable  state  (pQ,pt).  For  real  mutual  exclusion  elements  one  would  expect  these  probabilities  to 
be  close  to  0.5,  but  it  is  unreasonable  to  assume  that  they  are  both  exactly  0.5  for  all  mutual  exclusion 
elements:  one  would  expect  slight  variations  around  0.5.  From  a  theoretical  standpoint,  the  size  of 
the  interval  around  0.5  that  contains  these  probabilities  is  immaterial  as  long  as  zero  is  excluded.  In 
other  words,  expanding  that  interval  from  a  small  area  around  0  5  to  the  entire  open  unit  interval 
between  0  and  1  changes  neither  the  results  nor  their  proofs,  despite  our  expectation  that  the 
probabilities  do  not  lie  in  most  of  the  interval.  Excluding  0  and  t  as  probabilities  requires  tfiat  the 
metastable  state  exhibit  an  indecision  among  possible  choices,  admitting  0  and  I  allows  the  situation 


n  which  the  same  request  is  almost  always  granted  in  any  conflict,  and  thus  the  corresponding 
nutual  exclusion  element  cannot  possibly  be  fair  Our  main  result  is  the  following. 


Theorem  1  1:  Any  mutual  exclusion  element  for  which  pQ  and  are  not  zero  is  fair 


under  our  model  and  definitions. 

Proof:  According  to  our  definition  of  fairness,  it  is  sufficient  to  show  that  the  probability 
of  the  set  of  unfair  infinite  two-element  choice  sequences  is  zero.  For  arbitrary  positive 

p,  =  1)  we  proceed  as  follows: 


probabilities  p0  and  pi  (such  that  pQ 


Corresponding  to  a  single  choice  we  define  the  choice  measure  space  ('=■((  T  ft  )  as: 
•C  =  t90.9i> 

•  T  =  {0.{go}.{g,}.{go.g1}} 

•  ac(0)  =  0.  /ij{g0})  =  P0,Mc({g,})  =  PrMc({g0  g1})  =  P0  +  P, 


r  is  a  totally  finite  measure  space  such  that  /xclO  =  1  C  corresponds  directly  to  a  single 


choice  from,  the  two-element  choice  set. 


For  all  positive  integers  i.  let  P  =  C  Now  let  ( P  S./x)  be  the  cartesian  product  of  the  P  . 
From  theorem  10.  we  conclude  that  the  probability  measure  ;t  on  P  ;s  well  defined.  P  is 
therefore  the  probability  measure  space  of  infinite  two-element  choice  sequences 


Lemma.  Every  point  in  P  is  measurable  and  has  measure  zero. 


Proof.  Consider  an  arbitrary  one  point  subset  of  P.  {.*}.  a  is  the  infinite  sequence 
( x  .  r  ,  ...)  where  each  g,}.  For  n>Q.  let  ./  -  {1.2.  Then  u  ..  defines 

a  ./  cylinder /'  which  contains  {v}.  More  precisely  we  have 


{.v} 


nx  /-;  =  (ux  .e  'Y 

n= .  n  n= l  n 


where  denotes  the  complement  of  the  set  A.  S  is  a  o -algebra,  hence  it  is  closed  under 
complementation  and  countable  union  by  definition  Since  all  of  the  /:'  are  in  S  it  follows 
from  the  equalities  above  that  {  a}  S,  therefore  { v}  is  measurable  by  definition. 


To  find  the  measure  of  {a},  assume  -.711(100!  loss  of  generality  that  p  2  p,  t-rom  theorem 
10  and  the  definition  of  the  measure  space  P.  we  Know  that  the  measure  of  l.  is 

n 

[]  j l  (  >:  )  Under  our  assumption  on  pQ  and  pv  this  quantity  is  bounded  from  above  by 
(p,,)"  Since  !  a  I C  /.  for  all -I  we  conclude  that 
/!({»})£  Urn  inf(p0)'1 

n—  oc 

Since  (pj  '  is  a  geometric,  scries  with  common  ratio  p .  and  ft  p  ■  the  !im  m!  and  the 
limit  aio  identical  and  equal  to  0.  As  a  measure  u  must  L--  non  negative,  therefore 
;t({  1 1)  ---  0.  □  Lemma 

"1 

Lemma  The  set  of  unfair  infinite  two  •  t.-m.-r*  ..hou  -*  •  <  qu*>i-,c  --•  >•  notable  -ft 
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Proof:  An  unfair  infinite  two  element  choice  sequence  must  fail  to  grant  some 

continuously  asserted  request.  The  requires  that  after  some  finite  point  the  sequence 
becomes  either  g  repeating  or  gf  repeating.  Such  sequences  can  be  enumerated  by 
enumerating  their  prefixes  (assuming  the  last  element  of  the  prefix  is  the  first  element  of 
the  repeating  portion)  and  casting  out  duplicates  as  part  of  the  enumeration  process. 

□  Lemma. 

Since  the  set  of  unfair  infinite  two-element  choice  sequences  is  countable,  it  is  a 
countable  disjoint  union  of  the  sets  containing  its  individual  elements.  Each  of  these  sets 
has  measure  zero  by  the  first  lemma,  therefore  the  entire  set  of  unfair  infinite  two  element 
choice  sequences  also  has  measure  zero  because  any  measure  is  countably  additive. 

This  proves  the  theorem.  □ 

4.2.  Extension  to  Larger  Elements 

Having  proved  our  main  result  for  two  input  mutual  exclusion  elements,  we  now  extend  it  to  larger 
mutual  exclusion  elements.  The  maior  new  idea  in  this  proof  is  the  introduction  of  the  excluded 
choice  sets,  a  useful  class  of  sets  that  includes  the  Cantor  Set.  We  informally  discuss  our 
methodology  before  presenting  the  extended  proof. 

As  the  number  of  inputs  increases,  the  complexity  of  our  choice  set  model  also  increases.  To  avoid 
changing  the  spirit  of  our  approach  it  is  necessary  to  extract  subsequences  corresponding  to  each  of 
the  finitely  many  possible  multi-element  choice  sets,  each  choice  set  corresponds  to  a  different 
measure  space  and  product  space,  so  the  proof  that  the  unfair  sequences  have  measure  zero  must 
now  be  performed  once  for  each  multi  element  choice  set.  For  choice  sets  containing  exactly  two 
elements  the  proof  has  been  given  above,  but  for  choice  sets  containing  more  than  two  elements,  the 
set  of  unfair  sequences  becomes  uncountable  requiring  a  slightly  more  sophisticated  approach. 

For  choice  sets  containing  three  or  more  elements  the  main  theorem  above  is  still  true,  but  its  proof 
involves  the  infinite  sequence  analog  of  the  Cantor  Set  and  related  sets:  we  refer  to  these  as  excluded 
choice  sets,  and  note  that  they  are  needed  to  prove  the  larger  choice  set  versions  of  the  lemmas  in 
the  original  proof. 

Definition  1  2:  Excluded  Choice  Sets:  For  a  choice  set  C  and  an  excluded  set  ECC, 

the  n,h  excluded  choice  set.  xJi’O)  for  n>0.  is  the  set  of  infinite  sequences  of  elements 

from  C  such  that  no  element  of  E  occurs  m  the  subsequence  starting  at  the  n!h  position. 

(The  1 '  excluded  set  forbids  the  occurrence  of  elements  of  E.  the  a',!  allow:,  them  to  occur 
only  in  the  first  two  po.  mens.  etc  ) 

One  of  th  y.ie  sets  coir  -.pends  to  the  m  :f hematic al  ■  d  fit  /  known  ns  the  Cantor  The  Cantor  Cot 


is  construct-- I  by  taking  '.’i 


middle  third  (the  interval  from  1/3  to  2/3  without  endpoints),  then  deleting  the  open  middle  third  from 
the  two  intervals  thus  formed  and  so  on  ad  infinitum.  The  Cantor  Set  is  an  uncountable  nowhere 
dense  set  of  measure  zero  which  contains  all  of  its  limit  points;  as  such  it  is  a  common 
counterexample  in  mathematics.  In  our  framework  the  Cantor  set  corresponds  to  xj.  j({0,1 ,2})  where 
each  infinite  sequence  is  considered  as  the  ternary  expansion  of  a  number,  in  the  unit  interval 
between  0  and  1  inclusive.  To  our  knowledge,  this  is  the  first  use  of  the  Cantor  Set  in  computer 
science. 

For  an  n-input  mutual  exclusion  element,  we  denote  the  requests,  grants  and  respective 

probabilities  by  {rQ . r^},  {§0 . gn.1 }.  and  {pQ . pn-1}.  We  can  now  state  and  prove. the 

generalized  theorem. 

Theorem  13:  Any  n-input  mutual  exclusion  element  for  which  all  of  {pQ1  .  .  .  ,pn  .}  are 
non-zero  is  fair  under  our  model  and  definitions. 

Proof:  Based  on  our  above  discussion,  it  suffices  to  show  that  for  any  choice  set 
containing  more  than  one  element,  the  probability  of  unfair  infinite  choice  sequences  from 
all  the  elements  is  zero.  Let  n  be  the  size  of  an  arbitrary  such  set,  and  without  loss  of 
generality  assume  that  it  contains  {gQ1  . . .  ,g  }.  For  arbitrary  positive  probabilities 

{p0 . pn  ,}  such  that  2,1  q  P,  =  1  we  proceed  as  follows: 

Corresponding  to  a  single  choice  we  define  the  choice  measure  space  C  =  (C,T,fi<)  as: 

•c“  tea . 9n-i> 

•  T  =  9(C).the  powerset  of  C. 

•I*C(A)=  Zg.^P.for/feT. 

C  is  a  totally  finite  measure  space  such  that  ju,  (C )  =  1.  C  corresponds  directly  to  a  single 
choice  from  the  n-element  choice  set. 

For  all  positive  integers  /,  let  P  =  C.  Now  let  (P  S.fi)  be  the  cartesian  product  of  the  P. . 
Theorem  10  implies  that  the  probability  measure  fi  on  P  is  well  defined.  P  is  therefore  the 
probability  measure  space  of  infinite  n-element  choice  sequences. 

Lemma:  The  set  of  unfair  infinite  n-element  choice  sequences  is  the  countable  non- 

disjoint  union  of  the  of  where  E  ranges  over  all  singleton  sets  consisting  of  exactly 

one  element  from  C  and  m  ranges  over  the  positive  integers. 

Proof:  An  unfair  infinite  n-element  choice  sequence  must  fail  to  grant  some 
continuously  asserted  request,  say  r.  Such  a  sequence  is  in  x^j(f')  where  m  is  the 
sequence  position  at  which  starvation  begins. 


Conversefy,  any  element  of  X™g}(0  for  m  positive  must  fail  to  grant  the  request  r.  after 
position  m,  and  is  therefore  unfair.  □  Lemma. 


Lemma: 

For  g.  e  {gQ . and  m  positive,  X^g  j(C)  is  measurable  in  P  and  has  measure  zero. 

Proof:  For&>0,  let  (Jk  —  {m,m  + 1 . m  +  k—  1}.  Let  Ek  be  the  measurable  /^-cylinder 

defined  by  excluding  g.  from  the  positions  in  Jk.  Ek  contains  the  desired  excluded  choice 
set.  More  precisely  we  have 


where  A'  denotes  the  complement  of  the  set  A.  S  is  a  a-algebra,  hence  it  is  closed  under 
complementation  and  countable  union  by  definition.  Since  all  of  the  are  in  S  it  follows 


from  the  equalities  above  that  xlj-^Oe  S,  therefore  X™g  j(0 is  measurable  by  definition. 

To  find  its  measure,  let  pj  be  the  smallest  probability  in  {pQ, . . .  ,pn  ,}.  From  theorem  10 
and  the  definition  of  the  measure  space  P,  we  know  that  the  measure  of  Ek  is 

I!*-,  -  (£,})•  This  quantity  is  bounded  from  above  by  (1  -p.)*.  Since  x^j(0  CEk  for 

all  k  we  conclude  that 


E(xl.}(C))<  lim  inf(1-p.)* 

'  n — *  oo 

Since  (1-Pj)*  is  a  geometric  series  with  common  ratio  1  - p.  and  0<1-Pj<l,  the  lim  inf  and 
the  limit  are  identical  and  equal  to  0.  As  a  measure  p.  must  be  non-negative,  therefore 

M(X{;}(0)  =  0.  □  Lemma. 

From  the  above  two  lemmas  we  know  that  the  set  of  unfair  infinite  n-element  choice 
sequences  is  a  countable  non-disjoint  union  of  sets  of  measure  0.  Since  n  is  both  non¬ 
negative  and  countably  subadditive,  the  set  of  unfair  infinite  n-element  choice  sequences 
has  measure  0.  This  proves  the  theorem.  □ 


This  completes  the  proof  of  our  main  fairness  theorem  for  mutual  exclusion  elements  with  three  or 
more  inputs.  We  now  consider  the  implications  of  this  result  for  (multi-input)  arbiters  implemented 
with  more  than  one  mutual  exclusion  element. 


5.  Fairness  of  Multiple  Input  Arbiters 

This  section  builds  upon  our  fairness  result  for  mutual  exclusion  elements  to  establish  a  general 
fairness  result  for  arbiters  containing  one  or  more  mutual  exclusion  elements.  As  with  our  approach 
to  mutual  exclusion  elements,  we  first  define  an  abstract  model  of  such  arbiters  and  then  prove  our 
main  result  within  the  framework  of  that  model.  Throughout  this  section  we  are  most  interested  in 
asynchronous  arbiters,  i.e.  those  arbiters  that  impose  no  timing  constraints  on  the  presentation  of  the 
requests  among  which  they  arbitrate,  and  continue  to  function  in  the  absence  of  requests  from  one  or 
more  connected  processes.  Our  model  and  result  are  general  enough  to  be  applicable  outside  this 
domain,  but  they  do  not  apply  to  prioritized  or  daisy  chain  arbiters  in  which  one  request  has  absolute 
priority  over  another.  Such  arbiters  must  favor  a  request  of  higher  priority  over  one  of  lower  priority; 
this  can  result  in  starvation  of  the  lower  priority  request. 

5.1 .  Modeling  Arbiters 

Common  design  and  implementation  techniques  for  multiple  input  arbiters  use  multiple  mutual 
exclusion  elements  arranged  in  a  hierarchical  or  ring  formation.  A  request  from  one  process  using 
the  arbiter  must  then  be  granted  by  one  or  more  of  these  elements  before  actually  being  granted  by 
the  arbiter..  We  assume  for  this  work  that  the  arbiter  has  been  correctly  designed  to  implement  mutual 
exclusion  and  prevent  internal  deadlock. 

The  two  main  methodologies  for  designing  multi  input  arbiters  using  multiple  (usually  two-input) 
mutual  exclusion  elements  are  the  hierarchical  and  ring  methodologies. 

•  A  hierarchical  arbiter  uses  multiple  levels  of  mutual  exclusion  elements  and  surrounding 
circuitry  to  reduce  the  number  of  requests  to  two  which  are  finally  arbitrated  by  a  top- 
level  mutual  exclusion  element.  Thus,  a  particular  request  entering  the  arbiter  must 
obtain  a  fixed  sequence  of  grants  culminating  in  the  grant  from  the  top-level  element  to 
receive  a  grant  from  the  arbiter. 

•  A  ring  arbiter  arranges  mutual  exclusion  elements  and  surrounding  circuitry  in  a  ring 
around  which  a  single  token  or  privilege  travels.  Possession  of  the  token  or  privilege 
gives  a  ring  element  the  right  to  issue  a  grant  to  its  attached  request;  absence  of  the 
token  requires  a  request  to  obtain  it,  or  a  wait  for  it.  The  mutual  exclusion  element  is 
needed  in  each  ring  element  to  arbitrate  between  holding  the  token  to  grant  a  pending 
request  at  that  element  and  passing  the  token  along  the  ring  so  that  some  other  pending 
request  may  be  granted.  Thus  a  request  must  obtain  grants  from  all  the  mutual  exclusion 
elements  required  to  pass  the  token  around  the  ring  to  the  corresponding  element,  and 
finally  from  that  element  itself  This  sequence  ot  required  grants  depends  nnnn  the  token 
position  when  the  request  is  made:  since  the  ring  has  a  fixed  number  of  uk  meats,  there 
are  finitely  many  possible  positions  and  therefore  finitely  many  such  s>  ;;u-  nces  are 
possible. 
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Based  on  the  above,  our  model  of  arbiters  is  that  for  each  process  connected  to  the  arbiter  there 
are  one  or  more  finite  sequences  of  mutual  exclusion  elements  from  which  grants  must  be  obtained  in 
order  to  cause  the  arbiter  to  grant  a  request  from  that  process.  For  any  particular  request  from  a 
process,  exactly  one  of  these  sequences  is  appropriate;  this  sequence  is  determined  by  the  state  of 
the  arbiter  (token  position  in  the  case  of  a  ring)  when  the  request  is  made. 

5.2.  Fairness  Result 

The  following  definition  of  fairness  is  the  probabilistic  analog  of  the  standard  notion  of  weak 
fairness.  We  again  emphasize  that  these  two  notions  are  very  similar;  a  fairness  result  using  this 
definition  all  but  establishes  weak  fairness  for  arbiters. 

Definition  14:  Probabilistic  Weak  Fairness  for  Arbiters:  An  arbiter  is 

probabilistically  weakly  fair  if  any  continually  asserted  request  is  eventually  granted  with 
probability  1. 

Using  our  model  and  this  definition,  we  can  prove  the  following  result: 

Theorem  15:  All  arbiters  represented  by  our  model  are  fair  in  the  weak  probabilistic 
sense. 

Proof:  Let  r  be  an  arbitrary  request  and  Mr  .  .  .  ,Mn  the  corresponding  sequence  of 
mutual  exclusion  elements  from  which  grants  must  be  obtained  to  grant  r.  Our  result  on 
mutual  exclusion  element  fairness  implies  that  M1  will  eventually  grant  r  with  probability  1, 
thus  allowing  it  to  be  presented  to  M2,  which  eventually  grants  it  with  probability  1,  etc. 
Finally  r  is  presented  to  Mn  which  eventually  grants  it  with  probability  1.  thus  causing  the 
arbiter  to  grant  r.  Multiplying  these  probabilities  produces  the  result  that  r  is  eventually 
granted  with  probability  1  as  in  the  definition  of  probabilistic  weak  fairness.  Since  r  was 
arbitrary  this  establishes  the  theorem.  □ 

We  believe  that  this  theorem  essentially  settles  the  weak  fairness  question  for  arbiters;  essentially 
any  non-prioritized  asynchronous  arbiter  that  has  or  will  be  designed  falls  under  our  model,  and  is 
therefore  fair  under  our  definition  of  fairness.  This  definition  is  close  enough  to  weak  fairness  to 
essentially  settle  the  weak  fairness  question  for  arbiters. 

6.  Conclusion 

In  this  paper  we  have  considered  the  fairness  of  mutual  exclusion  elements,  the  most  important 
building  block  for  any  arbiter.  A  probabilistic  choice  set  model  has  been  introduced  to  capture  the 
choice  behavior  of  such  elements.  Using  this  model  on  infinite  sequences  we  have  defined  a 
probabilistic  notion  of  fairness,  and  shown  that  mutual  exclusion  elements  are  fair  in  general, 
provided  that  a  simple  assumption  about  their  probabilistic  behavior  is  satisfied,  (Any  well  designed 
mutual  exclusion  element  does  satisfy  the  assumption  )  We  have  also  extended  this  result  to 


establish  the  fairness  of  a  wide  class  of  arbiters  including  virtually  all  known  non-prioritized  multi¬ 
input  designs.  This  essentially  settles  the  weak  fairness  question  for  non-prioritized  arbiters;  in 
general  such  arbiters  are  fair  in  a  sense  that  is  very  close  to  the  standard  notion  of  weak  fairness. 
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